America Names the Model Thieves

On Tuesday, the NSA, CISA, and the FBI issued a joint advisory naming six Chinese AI companies (DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI) as running industrial-scale “distillation” attacks against U.S. frontier models since at least late 2024, “likely” with “Chinese government awareness.” The targets: variants of Claude, GPT, Gemini, and Grok. The agencies say the stolen capabilities “form the core” of China’s AI development strategy, sparing Chinese firms billions in training costs and years of development time.

Allegedly, swarms of fake accounts, bought in bulk and routed through a gray market of proxies to dodge geographic restrictions, fired coordinated queries ranging from thousands to millions per topic. Then, prompt-injection jailbreaks forced models to expose their hidden chain-of-thought.

The advisory says DeepSeek used prompts instructing models to imagine the internal reasoning behind completed responses and write it out step by step. DeepSeek allegedly distilled agentic functions, writing optimization, and reasoning from Claude, Gemini, GPT, and Grok. Moonshot switched between U.S. models to extract fine-tuning, reinforcement learning, software engineering, and math. Alibaba, MiniMax, StepFun, and Z.AI focused on specific Anthropic and OpenAI models. The individual accusations are not new; OpenAI flagged DeepSeek last year, Google reported attackers prompting Gemini more than 100,000 times in a cloning attempt, and Anthropic accused Alibaba of the largest-ever cloning attack on Claude. Unsurprisingly, China’s Foreign Ministry called the accusations “groundless” and credited “high-level scientific and technological self-reliance.”

Author’s note: This is not a sponsored post. I am the author of this article and it expresses my own opinions. I am not, nor is my company, receiving compensation for it. This work was created with the assistance of various generative AI models.